{"id":"ce8b9390-406d-479f-be27-4ff3b221ab23","arxiv_id":"2506.19260","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"The paper derives a per-client mutual-information bound for topology-aware leakage in differentially private federated learning and a min-max noise allocation that improves the bound over uniform noise when leverage scores are unequal.","lead":"This paper argues that the communication topology of a federated learning system leaks information about clients even when standard differential privacy is used, and proposes a noise-allocation scheme that reduces a worst-case bound when the topology is asymmetric. It also introduces a shadow-model decomposition that separates leakage into parameter, structural, and organisational channels.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unconditional-safety claim depends on degree/dataset-size leverage proxies that are not proven upper bounds on ell^circ_i; if a proxy underestimates a high-exposure client's leverage, FULCRUM can allocate less noise than uniform DP-SGD and break the per-client MI guarantee.","rationale":"The paper's theoretical core is internally coherent: the additive decomposition of Theorem V.2 is a plausible chain-rule + RDP argument, Theorem V.3 is a standard water-filling KKT solution, and Corollary V.4 holds whenever the quantities fed into the allocation are the true structural leverage scores. The empirical TADI channel decomposition, especially the uniformly negative parameter-channel lift and the matched-prior realization of the prior-coupling term, provides supporting evidence that the threat model is meaningful. The reader's weakest_assumption identifies exactly the load-bearing gap: the practical guarantee depends on the leverage proxies upper-bounding the true structural leverage, which is proven only for the group-size proxy asymptotically and remains open for the degree and dataset-size proxies. This is not a minor caveat. If a proxy underestimates ell^circ_i for some client, FULCRUM can allocate less noise to that client than uniform DP-SGD, and the per-client MI bound of Theorem V.2 is not guaranteed; the claimed strict dominance of Corollary V.4 then does not transfer to the implemented system. Section VII admits this explicitly, while the abstract and conclusion nonetheless assert unconditional safety. The Figure 3 eta-dependence inconsistency and the reversed explanation in Lemma A.3 are additional concerns, but the proxy upper-bound issue alone is sufficient to preclude acceptance as stated. The proposed concrete test would settle the matter computationally by comparing true-leverage-based allocations against the degree proxy on the actual evaluated topologies. Since the reader already recommended CONDITIONAL and the concern reinforces that judgment rather than overturning it, the verdict is unchanged.","tokens_in":23131,"tokens_out":8034,"duration_ms":78805,"concrete_test":"Numerically approximate ell^circ_i = sup_{P in F_G,omega} I_P(p_i; D_-i) for the degree proxy over the same SBM/Dirichlet prior family used in Section V-E for the Figure 3 topologies (star, BA m=2, BA m=4, ER p=0.5) at eta=1, then recompute FULCRUM's sigma_i^2 from Theorem V.3 using these true leverage values. Check whether any client's achieved per-client bound a/sigma_i^2 + ell^circ_i exceeds the uniform allocation's worst-case bound K_uniform = an/U + max_j ell^circ_j. If it does for any client in any topology, the degree proxy underestimates true leverage and the unconditional dominance claim is falsified; if it never does across all tested topologies and seeds, the concern is resolved for Setting C.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem V.2 guarantees the per-client MI bound only when the allocation uses the true structural leverage ell^circ_i (Definition V.1) or a quantity that upper-bounds it. Theorem V.3 and Corollary V.4 inherit this requirement: the achieved per-client bound is a/sigma_i^2 + ell^circ_i, with sigma_i^2 = a/(K* - ell~_i). If ell~_i < ell^circ_i for any client i, the allocation gives that client less noise than the true optimum, and its achieved bound can exceed both K* and K_uniform = an/U + max_j ell^circ_j. Section V-E states that only the group-size proxy satisfies an asymptotic upper-bound condition; for the degree proxy (ell^deg_i proportional to deg_G(i)) and the dataset-size proxy (ell^ds_i proportional to |D_i|/mean|D|), a tight upper bound on ell^circ_i remains open. Section VII explicitly concedes: 'In deployments where a proxy underestimates ell^circ_i for some client, the per-client bound of Theorem V.2 for that client is not guaranteed; the Pareto dominance results of Section VI-D then constitute empirical rather than theoretical evidence of improvement.' Yet the abstract and conclusion claim FULCRUM is 'safe to adopt unconditionally' and Corollary V.4 is stated without this caveat, so the central advertised guarantee is not established for two of the three proxies used in the evaluation. This is an internal gap between the theorem's assumptions and the implemented allocation, not a disagreement with external consensus.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies a passive adversary who knows the communication topology and organisational labels of a federated learning system and attempts to infer each client's sensitive-class concentration p_i from the sequence of DP-protected model updates. The authors define a 'structural leverage' ℓ^◦_i as the worst-case mutual information between p_i and the other clients' datasets, prove an additive per-client bound separating a noise-controllable term from this leverage floor (Theorem V.2), and derive a closed-form min-max noise allocation (FULCRUM, Theorem V.3) that they claim strictly dominates uniform DP-SGD whenever the leverage scores are non-uniform (Corollary V.4). They also present TADI, a shadow-trained regressor with four channel ablations, and evaluate FULCRUM and TADI on Fed-ISIC2019, Fed-Heart-Disease, and synthetic CIFAR-10 across several topology families.","tokens_in":23367,"tokens_out":10716,"duration_ms":110011,"significance":"If the main claims were fully established, this would be a useful contribution to an underexplored intersection of FL privacy and topology: framing topology as a known leakage channel rather than only as a privacy amplification mechanism is novel, and the closed-form allocation is elegant and easy to implement. The paper ships code and uses a careful equivalence-testing protocol for utility comparisons. However, the advertised unconditional guarantee is not supported: the theorem's per-client bound is only meaningful when the leverage proxy upper-bounds the true ℓ^◦_i, which the paper itself leaves open for two of the three proxies, and the reported η-dependent privacy-bound gaps in Section VI-C are not predicted by the stated theory for topology-only proxies. The contribution is potentially valuable, but the central claims need substantial clarification and narrowing.","major_comments":[{"comment":"The per-client guarantee of Theorem V.2 is not preserved under two of the three proposed proxies. Theorem V.2 bounds I(p_i; \\hat p_i) by a/σ_i^2 + ℓ^◦_i, with ℓ^◦_i the true structural leverage of Definition V.1. When the allocation is computed from a proxy \\tilde ℓ_i, the achieved per-client bound is a/σ_i^2 + ℓ^◦_i, where σ_i^2 = a/(K^* − \\tilde ℓ_i). If \\tilde ℓ_i < ℓ^◦_i for some client, that client receives less noise than the true optimum and the per-client bound of Eq. (2) is not guaranteed. Section V-E states that a tight upper bound on ℓ^◦_i remains open for the degree and dataset-size proxies, and Section VII explicitly concedes that 'the per-client bound of Theorem V.2 for that client is not guaranteed' when a proxy underestimates ℓ^◦_i. The abstract and conclusion nevertheless claim FULCRUM is 'safe to adopt unconditionally'. This is an internal inconsistency in the central advertised guarantee, not merely a presentation issue.","section":"Sections V-E and VII"},{"comment":"The uncontrollable term in Theorem V.2 is definitional rather than derived. Since ℓ^◦_i is defined as sup_{P∈F_G,ω} I_P(p_i; D_{−i}), the second term of Eq. (2) is exactly the supremum of the lateral mutual information that the chain-rule proof already isolates. Consequently Theorem V.2 provides no upper bound that is computable from (G,ω) alone unless an independent upper bound on this supremum is supplied. The statement in Section V-E that Theorems V.2 and V.3 hold for any non-negative weight vector substituted in place of {ℓ^◦_i} confirms that the min-max allocation optimizes an abstract weight profile rather than a quantity tied to actual privacy risk; the paper should explicitly frame the result as a decomposition and should state that all concrete privacy guarantees require a validated conservative proxy.","section":"Definition V.1 and Theorem V.2"},{"comment":"The reported η-dependence of the privacy-bound gap is not a consequence of the stated theory. The leverage proxies in Section V-E are functions of (G,ω) and dataset sizes only, and ℓ^◦_i is a supremum over F_G,ω, so for a fixed topology the gap K_uniform − K^* in Corollary V.4 should be independent of the coupling parameter η. Figure 3 shows the gap growing monotonically in η and saturating at star and BA topologies, which indicates that the leverage values used to compute K^* and K_uniform in this experiment depend on the realized generative model rather than on the public topology alone. The paper does not specify how ℓ^◦_i is instantiated in Setting C, so the claimed empirical confirmation of Corollary V.4 is not reproducible from the described methodology.","section":"Section VI-C, Figure 3"}],"minor_comments":[{"comment":"The phrase 'privacy gains' should be replaced with 'privacy-bound reductions' throughout, because the 1.967 nats figure and the other reported gaps are reductions in an upper bound, not reductions in actual mutual information.","section":"Abstract and Conclusion"},{"comment":"The group-size proxy's claim that ℓ^◦_i ≤ H(Φ_{ω_i}) asymptotically needs a formal statement of the asymptotic regime and the assumed stochastic block model; as written, the sentence is not precise enough to be checked.","section":"Section V-E"},{"comment":"The argument in Step 2 of Lemma A.3, which replaces conditioning on θ^{(<t)} by conditioning on θ^{(t−1)}, is compressed and does not immediately follow from the displayed Markov-chain statement; since this is a central composition step, a fuller proof should be supplied.","section":"Appendix A, Lemma A.3"},{"comment":"The evaluation section states that noise scales are set via σ^{*2}_i = a/(K^* − ℓ^◦_i), but the practical implementations use proxies; the paper should state explicitly which proxy is used for each setting and each figure, including Figure 3 and Figure 4.","section":"Section VI-B"},{"comment":"The colorbar label 'an/U Kuniform K*' is unclear; the figure caption and the axis label should state unambiguously that the color encodes K_uniform − K^* in nats.","section":"Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The referee believes the paper addresses an interesting problem and the min-max optimization section is solid, but the gap between the proof's assumptions and the implemented allocation, together with the unexplained η-dependence in Figure 3, prevents acceptance in current form. If the authors can prove or conservatively calibrate upper-bound properties for the degree and dataset-size proxies and clarify or recompute the Setting C experiments, the paper may become suitable. No concerns about attribution or scope were identified."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my read on 2506.19260. The core idea is real: nobody has treated topology as a known leakage channel in DP-FL, and this paper is the first to decompose per-client leakage into a noise-controllable mechanism term and a structural prior-coupling floor. The TADI four-ablation decomposition is a sensible empirical instrument, and the water-filling allocation in Theorem V.3 is textbook-correct KKT. Credit where earned: the evaluation is unusually thorough — three benchmarks, six topology families, TOST equivalence testing, released code. Section VII is candid about what is not proven.\n\nThe soft spots are all in the gap between the theorems and the claims. The big one is the leverage proxies. Theorem V.2 only guarantees the per-client MI bound when the weights upper-bound the true structural leverage. Only the group-size proxy has a bounding result, and it's asymptotic; the degree and dataset-size proxies are explicitly unproven. If a proxy underestimates a high-exposure client's leverage, the allocation gives that client less noise than uniform DP-SGD and the per-client guarantee collapses. Section VII admits exactly this, yet the abstract and conclusion say 'safe to adopt unconditionally.' That is not supported. This is an internal gap.\n\nSecond, Figure 3's eta-sweep does not reproduce from the text. The proxies are described as functions of degree, group size, or dataset size — all eta-independent in Setting C — yet the gap grows monotonically with eta. Either an eta-dependent quantity is entering the leverage computation, or the figure was produced by something other than the described method. The central empirical validation is unreproducible as written.\n\nThird, the 'uncontrollable floor' ell^o_i is defined as the supremum of I(p_i; D_-i), the very quantity in question. That makes the second term of Theorem V.2 definitional rather than derived. The bound isn't wrong — bounding a term by its supremum is fine — but the paper should say plainly that the floor is a worst-case construction, not a derived quantity. Note that Theorem V.3 holds for any weight vector, so the allocation itself is robust; only the per-client guarantee inherits the proxy problem.\n\nMinor point: Lemma A.3's conditioning explanation is muddled. The inequality is standard sigma-algebra monotonicity, but the Markov-chain argument as written goes the wrong way. Easy fix.\n\nBottom line: the threat model and the channel decomposition deserve the FL privacy community's attention. This paper deserves peer review, not desk rejection, but it needs major revision: prove or drop the proxy upper-bound story, make the eta-sweep reproducible, and consistently separate bound reductions from measured privacy gains. I'd send it out.","headline":"Genuinely new threat model and a plausible bound, but the unconditional-safety claims outrun what the proxies prove; deserves a serious referee.","tokens_in":23972,"tokens_out":9418,"would_cite":true,"duration_ms":78901,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves that a federation's communication topology leaks client statistics that DP-SGD noise cannot suppress, and derives a closed-form noise allocation provably better than uniform DP-SGD whenever the topology is asymmetric.","keywords":["federated learning","differential privacy","network topology","mutual information","distributional inference","per-client noise allocation","cross-silo federated learning","structural leverage"],"falsifier":"Build a small federation ($n \\le 10$) where the true structural leverage $\\ell_i^\\circ$ can be computed by enumerating priors in $\\mathcal{F}_{G,\\omega}$, and compare it with each deployed proxy: if any graph or dataset-size assignment yields $\\ell_i^\\circ$ greater than the proxy for some client, the proxy is not an upper bound and that client's per-client guarantee fails. Alternatively, run the full-channel TADI adversary against a Fulcrum-protected federation and check whether any client's measured leakage exceeds $T_{\\max}/(2\\sigma_i^{*2}|B|^2)$ plus the proxy value, an exceedance that would show the allocation under-noised an exposed client.","tokens_in":22851,"feed_emoji":"🔒","tokens_out":24701,"duration_ms":187731,"temperature":0.7,"pith_summary":"Federated learning sends only model updates to the server, and DP-SGD is supposed to bound what those updates reveal, but this paper argues that the network that carries them leaks on its own. A passive adversary who knows the communication topology and each client's organizational membership can infer per-site sensitive-class concentrations, such as a hospital's melanoma rate, through a channel that DP-SGD never touches. The authors prove that this leakage separates additively into a controllable mechanism term that per-client noise can shrink and an uncontrollable prior-coupling floor fixed by the client's structural position. From the bound they derive Fulcrum, a closed-form per-client noise allocation that minimizes the worst-case bound and strictly dominates uniform DP-SGD whenever leverage scores are asymmetric, degenerating exactly to uniform DP-SGD when they are not. If the result holds, federations get strictly more privacy per unit of utility cost by reallocating noise according to topology, with measured bound reductions up to about two nats (natural units of information) on real healthcare benchmarks.","feed_headline":"Beats uniform differential privacy on lopsided federations","feed_subtitle":"A federation's wiring leaks client statistics; a closed-form noise rule restores privacy at no utility cost.","key_machinery":"The load-bearing object is structural leverage $\\ell_i^\\circ$, the worst-case mutual information $I_P(p_i; D_{-i})$ between a client's sensitive-class concentration and all other clients' datasets, taken over the prior family consistent with the deployment graph and organizational labels; it quantifies how much a client's structural position alone reveals about its data. The additive bound is assembled from the data-processing inequality and the mutual-information chain rule; the mechanism term is bounded by Rényi-DP composition for the Gaussian mechanism with sensitivity $C/|B|$, converted to mutual information via the max-KL conversion of [26]. The allocation itself solves a convex min-max program with a slack variable $K$: KKT stationarity forces every per-client constraint active, giving the closed form $\\sigma_i^{*2} = a/(K^* - \\ell_i^\\circ)$ with $K^*$ the unique root of the budget equation, which equalizes the worst-case bound across clients. Three practical proxies, group size, graph degree, and dataset size, stand in for the abstract $\\ell_i^\\circ$ in deployment, each matched to the dominant source of asymmetry.","core_discovery":"The paper's central claim, Theorem V.2, is that under independent DP-SGD noise and disjoint client datasets, any deterministic adversary extracting an estimate $\\hat{p}_i$ of client $i$'s sensitive-class concentration from the observed update tensor satisfies $I(p_i; \\hat{p}_i \\mid G, \\omega, \\{\\sigma_j\\}) \\le T_{\\max}/(2\\sigma_i^2 |B|^2) + \\ell_i^\\circ$ for any prior in the family $\\mathcal{F}_{G,\\omega}$: a controllable mechanism term that decays as the client's noise $\\sigma_i$ grows, plus an uncontrollable prior-coupling floor $\\ell_i^\\circ = \\sup_{P \\in \\mathcal{F}_{G,\\omega}} I_P(p_i; D_{-i})$ that measures how predictable $p_i$ is from the rest of the federation's data. Theorem V.3 then derives Fulcrum's balanced min-max allocation $\\sigma_i^{*2} = a/(K^* - \\ell_i^\\circ)$, where $a = T_{\\max}/(2|B|^2)$ and $K^*$ is the unique root of $\\sum_i a/(K^* - \\ell_i^\\circ) = U$ for a fixed total noise-variance budget $U$; Corollary V.4 states the resulting worst-case bound $K^*$ is strictly below uniform DP-SGD's unless all leverage scores are equal. The TADI channel decomposition, a shadow-trained regressor with four ablations, confirms the additive structure empirically: the parameter channel never beats the constant-mean baseline, while the organizational channel reaches perfect client ranking exactly when the adversary's shadow prior matches the deployment prior. Across Fed-ISIC2019, Fed-Heart-Disease, and synthetic CIFAR-10 with nine topology configurations, the allocation reduces the privacy bound by up to 1.967 nats with statistically equivalent utility.","pith_inferences":["A concrete hazard follows from the paper's own limitation: if a degree or dataset-size proxy understates $\\ell_i^\\circ$ for any client, Fulcrum could allocate that client less noise than uniform DP-SGD; a safety-margin inflation of the proxies, calibrated on the TADI full-channel adversary, would close the gap.","The bound's two sources of slack, the dropped term $I(p_i; D_{-i} \\mid \\Theta)$ and the loose conversion at extreme noise, point to a tighter accountant (amplified RDP scaling the mechanism term from $1/(\\sigma_i^2 |B|^2)$ toward $1/(\\sigma_i^2 |D_i|^2)$), which would strengthen per-client guarantees when local datasets are much larger than batch sizes.","Equalizing the worst client is one policy; minimizing the average bound instead would trade a slightly worse worst case for lower typical leakage, a variant worth evaluating where aggregate exposure is the legal concern.","The channel decomposition suggests a deployment-time diagnostic: use matched-prior TADI lifts as an empirical estimate of $\\ell_i^\\circ$ and compare with the chosen proxy's ranking, letting operators validate the proxy before trusting the allocation."],"forward_implications":["Fulcrum lowers the worst-case per-client privacy bound at every tested utility budget and observation window across all three benchmarks, by up to 1.967 nats on Fed-ISIC2019, with no measurable utility cost (equivalence within ±0.5 percentage points).","On symmetric topologies, rings, complete graphs, balanced hierarchies, the allocation degenerates exactly to uniform DP-SGD, so adopting it never worsens privacy in a symmetric federation.","The TADI decomposition shows the parameter channel is already bounded by DP-SGD in every configuration tested, so the residual, noise-immune risk sits in the prior-coupling channel.","The prior-coupling floor is empirically realizable only when the adversary's shadow prior matches the deployment prior; under the realistic public-proxy construction it is not reached, making the bound conservative in the deployment's favor.","The group-size proxy asymptotically upper-bounds true leverage under stochastic block model priors, while the degree and dataset-size proxies are supported by ordering consistency and Pareto dominance across tested settings."],"supporting_citations":[{"why":"Defines the DP-SGD Gaussian mechanism whose clipping sensitivity and per-client noise scale produce the per-round bound underlying the controllable leakage term.","marker":"[9]"},{"why":"Supplies the Rényi differential privacy composition used to sum the per-round Gaussian bound across the full observation window into the mechanism term.","marker":"[11]"},{"why":"Provides the max-KL conversion that turns the Rényi bound into the mutual-information quantity stated in Theorem V.2.","marker":"[26]"},{"why":"Introduces the shadow-model paradigm on which TADI's shadow-trained regressor and its four channel ablations are built.","marker":"[7]"},{"why":"Instantiates DP-SGD in federated averaging as DP-FedAvg, the uniform-allocation baseline that Fulcrum must dominate.","marker":"[10]"},{"why":"Gives the convergence analysis that justifies treating total noise variance as the utility-budget constraint in the allocation.","marker":"[24]"},{"why":"Supplies the Fed-ISIC2019 and Fed-Heart-Disease benchmarks whose site-size heterogeneity drives the largest measured privacy-bound gaps.","marker":"[18]"}],"fun_headline_variants":["Topology leaks client data; new defense beats uniform DP","Asymmetric federations need smarter noise: Fulcrum does it","Shadow training isolates leakage; noise rule provably optimal","Privacy gain 1.967 nats: topology-aware noise allocation","Don't ignore wiring: new DP bound uses federation shape"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee as deployed relies on the chosen leverage proxy never understating a client's true structural leverage $\\ell_i^\\circ$; the paper proves that upper-bound property only for the group-size proxy and only asymptotically, and explicitly leaves a tight upper bound open for the degree and dataset-size proxies, so a proxy that underestimates $\\ell_i^\\circ$ could let Fulcrum give a highly exposed client less noise than uniform DP-SGD would.","fun_headline_variants_meta":{"raw":{"variants":["Topology leaks client data; new defense beats uniform DP","Asymmetric federations need smarter noise: Fulcrum does it","Shadow training isolates leakage; noise rule provably optimal","Privacy gain 1.967 nats: topology-aware noise allocation","Don't ignore wiring: new DP bound uses federation shape"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000249,"raw_usage":{"total_tokens":1684,"prompt_tokens":1214,"completion_tokens":470,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":830,"completion_tokens_details":{"reasoning_tokens":387}},"tokens_in":830,"tokens_out":470,"duration_ms":5584,"temperature":1.0,"reasoning_tokens":387,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:35:45.816132+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Build a small federation ($n \\le 10$) where the true structural leverage $\\ell_i^\\circ$ can be computed by enumerating priors in $\\mathcal{F}_{G,\\omega}$, and compare it with each deployed proxy: if any graph or dataset-size assignment yields $\\ell_i^\\circ$ greater than the proxy for some client, the proxy is not an upper bound and that client's per-client guarantee fails. Alternatively, run the full-channel TADI adversary against a Fulcrum-protected federation and check whether any client's measured leakage exceeds $T_{\\max}/(2\\sigma_i^{*2}|B|^2)$ plus the proxy value, an exceedance that would show the allocation under-noised an exposed client.","supporting_citations":[{"cited_title":"Deep learning with differential privacy,","cited_arxiv_id":null,"evidence_quote":"Defines the DP-SGD Gaussian mechanism whose clipping sensitivity and per-client noise scale produce the per-round bound underlying the controllable leakage term."},{"cited_title":"Differential privacy as a mutual information constraint,","cited_arxiv_id":null,"evidence_quote":"Provides the max-KL conversion that turns the Rényi bound into the mutual-information quantity stated in Theorem V.2."},{"cited_title":"Membership inference attacks against machine learning models,","cited_arxiv_id":null,"evidence_quote":"Introduces the shadow-model paradigm on which TADI's shadow-trained regressor and its four channel ablations are built."},{"cited_title":"Learning differentially private recurrent language models,","cited_arxiv_id":null,"evidence_quote":"Instantiates DP-SGD in federated averaging as DP-FedAvg, the uniform-allocation baseline that Fulcrum must dominate."},{"cited_title":"Federated learning with differential privacy: Al- gorithms and performance analysis,","cited_arxiv_id":null,"evidence_quote":"Gives the convergence analysis that justifies treating total noise variance as the utility-budget constraint in the allocation."},{"cited_title":"Flamby: Datasets and bench- marks for cross-silo federated learning in realistic healthcare settings,","cited_arxiv_id":null,"evidence_quote":"Supplies the Fed-ISIC2019 and Fed-Heart-Disease benchmarks whose site-size heterogeneity drives the largest measured privacy-bound gaps."}],"review_version":2}